Network protocol analyzers are widely used to monitor computer network performance and assist users in analyzing the causes of network slowdowns or outages. Protocol analyzers assist in explaining possible causes for network problems, collect expert analysis data automatically, learn network configurations continuously, show breakdown of network protocol activity automatically, display network errors, frame size, and station statistics, enable creation and generation of management reports, consolidate information from remote sites at a central location, point out problems proactively by communicating alarms to a central location, and display multiple windows concurrently allowing a service person to view prioritized alarms, global statistics, traffic statistics, and expert analysis information from one or several servers simultaneously. An exemplary protocol analyzer is the Sniffer Pro 3.0 currently available from Network Associates, Inc, described in the user's manuals for the Sniffer Pro 3.0® and Sniff Master® for Windows, the contents of which are hereby incorporated by reference. Protocol analyzers are described in various white papers, available at Network Associate's website, http://www.nai.com, and specifically at the webpage http://www.nai.com/asp_set/buy_try/try/whitepapers.asp, hereby incorporated by reference as of the filing date of this application.
FIG. 1 is a diagram of an exemplary enterprise network 100, comprising a plurality of local area networks 104,106, 108 and 110. Local area networks 104, 106 and 110 are connected via routers 132 and 134. Local area network 108 is a remote network coupled to the remaining network through the Internet 112 and gateway devices 114 and 116. The network 100 includes a protocol analysis server 140, and protocol analysis agent computers 148, 150 and 152, to provide monitoring and troubleshooting information for the entire network 100. Protocol analysis software, such as the Sniffer Pro 3.0, loads onto protocol analysis server 140 and may also comprise remote agents that are loaded onto the protocol analysis agent computers 148, 150, and 152. The protocol analysis software compiles and displays information on network activity from the data-collecting protocol analysis agent computers 148, 150, and 152.
For many network topologies, including Gigabit Ethernet, communication requires establishing a point-to-point link—that is, the link at the physical layer. To establish this link, the two devices attempting to communicate go through a training and negotiation process until an agreement is reached on parameters for communication. If no agreement is reached within some reasonable period (on the order of several seconds), or an error condition occurs, the attempt to establish a link has failed.
An example of this process for Gigabit Ethernet is shown in FIG. 2. At time t0, node 1 initiates the training and negotiation process by sending information in the form of an “auto-negotiation ordered set” to node 2. The auto-negotiation ordered set is the physical link layer handshake protocol control packet used for Gigabit Ethernet. An auto-negotiation ordered set includes of several copies of an auto-negotiation configuration register value, reg_value, transmitted with alternating headers. The two alternating headers are /C1/ and /C2/, consist of two ten-bit codes, and signify that what follows is an auto-negotiation configuration register value. The register value is conveyed by two 10-bit codes, which are converted to two eight-bit words corresponding to hexadecimal characters. The register value consists thus consists of one sixteen bit word. The individual bits in the sixteen-bit word have meanings defined by the protocol standard, indicating the various capabilities of the sending node. The receiving node responds at time t1 with its own auto-negotiation configuration register value, indicating its own capabilities, along with an acknowledgment.
The two nodes continue to modify their requirements, as reflected in the auto-negotiation configuration register value, until an agreement is reached. When a node receives an acceptable auto-negotiation configuration register value from the other node, the node transmits an “IDLE” signal. When both nodes transmit “IDLE” signals an agreement has been reached and frames may be sent. Details of the auto-negotiation process, the ten-bit to eight-bit conversion, and the register values for Gigabit Ethernet are described in the IEEE 802.3z standard, the contents of which are hereby incorporated by reference into the present application.
Prior art protocol analyzers are directed primarily to gathering and analyzing information relating to data transmission—that is, the frames of data exchanged by the various devices attached to the network. Efforts to establish the physical layer link are not traditionally visible to users. As shown in FIG. 3, the protocol analyzer does not begin capture 303 or analysis 304 until after a link is established 302. Until the link is established 302, no frames of data can be exchanged. For relatively low-speed communication protocols, establishing a link is usually not problematic, because the technology for low-speed links is mature.
However, for some high-speed topologies such as Gigabit Ethernet, many network failures occur during attempts to establish a link. For example, one device may have communication requirements that are incompatible with another device, or a device may not modify its requirements appropriately in order to reach an agreement. Most prior art protocol analyzers fail to capture any information on the training and negotiation process, requiring the use of one or more logic analyzers to capture the information as digital waveforms, and extensive effort to decode the information. That is, the physical link layer handshake protocol control packets are not captured by these prior art protocol analyzers. Furthermore, those prior art protocol analyzers that do capture the physical link layer handshake protocol control packet provide no merged information and no decoding or analysis, requiring a time-consuming process to troubleshoot the link failure. For example, as shown in FIG. 4, Version 2.5 of Network Associate's Sniffer Pro® protocol analyzer captures the auto-negotiation ordered sets 401 for each of the two channels between the two devices—one channel transmitting in each direction—and displays the raw binary and converted hexadecimal auto-negotiation ordered sets for each channel on a separate page 405, without merging the information for the two channels onto a single, time-ordered display. The auto-negotiation ordered sets for each channel are kept in the order in which they were sent 402 on separate displays for each channel. No decoding or analysis is provided for the auto-negotiation ordered sets—only for the frame data.
FIGS. 5a-5i are screen displays for Sniffer Pro v.2.5 corresponding to the process shown in FIG. 4. FIG. 5a is a screen display of the main menu, before the training and negotiation process is initiated. Neither channel is up, and the capture buffers are both empty. FIG. 5b is the help menu describing the various display capabilities. FIGS. 5c-5e show the sequentially-ordered auto-negotiation ordered sets 405 for channel 1, corresponding to node 1. The auto-negotiation register values and frame information are provided in hexadecimal in the first two columns, and decoding for the frame information and the idle signals is provided in the third column. The time stamps appear in the far right column.
The first auto-negotiation ordered set appears on FIG. 5c at timestamp 01:998:509:424, in units of seconds: milliseconds: microseconds: nanoseconds. The training and negotiation is complete and the link established 404 by timestamp 08:856:536:079, when channel 1 has transmitted several idles, and the start_of_frame is transmitted. FIGS. 5f-5h show the auto-negotiation ordered sets 403 in raw binary form. The raw binary information is provided in the first column, along with the corresponding 8 bit register values in hexadecimal in the second column—that is, the 8 bits is the hexadecimal value corresponding to a ten-bit code. The third column is the header information, which provides the name of the corresponding ten-bit code; the code may be either a control code or a data code. Corresponding hexadecimal and raw data for channel 2 is shown in FIGS. 5i-5l. 
Once both channels are carrying the idle signal, the link is established 404 and frame data is captured 405. FIG. 5m shows frame data for channel one in hexadecimal form, and FIG. 5n shows decoded frame data 406. FIGS. 5o and 5p show hexadecimal and decoded frame data 406 for channel 2. Finally, FIG. 5q shows a merged view of the decoded frame data for both channels 406.
As shown in FIGS. 5a through 5q, decoding is provided only for the frame data and the idle state. The raw auto-negotiation ordered set data is converted from 10-bit to hexadecimal form, but no decoding—no bitwise explanation of the register value—is provided. Furthermore, although the frame data from both channels is merged, the auto-negotiation ordered sets for the two channels are not merged to facilitate analysis of a link failure. Instead, the auto-negotiation ordered sets for each channel are shown in a separate display. Thus, a user attempting to determine why the devices failed to establish a link, using the information provided in FIGS. 5c through 5l, must go through a tedious and time-consuming process. First, the user must combine the information from channel 1 and channel 2, locating the timestamps for each auto-negotiation ordered set, and putting the merged auto-negotiation ordered sets for both channels in sequential order. Then, for each auto-negotiation ordered set, the user must look up and decode the register value in a reference such as the IEEE 802.3z standard. This decoding must be distinguished from simply identifying the hexadecimal value corresponding to a ten-bit code: here, “decoding” means that the user must look up the meaning of each individual bit to determine the configuration represented by the register value. Finally, the user must analyze the sequence of events to determine the cause of the failure and identify a possible solution.
Accordingly, it would be desirable to provide a protocol analyzer which captures, merges, decodes, analyzes and displays information on the training and negotiation process used to establish a link—that is, the physical link layer handshake protocol control packets.
It would be further desirable to provide an function to determine the cause of a failure to establish a link, based on an analysis of the failure of the training and negotiation process.